Splunk Search

Arranging the tabular columns and removing the empty fields in the table

KR1
Loves-to-Learn Lots

Hi,

I am working on a query where i need to display the table based on the multiselect input.
multi-select input options are : (nf, sf, etc)

When i select "nf " then only columns starts with "nf" should display along with "user" and "role" and also display the columns in same order as it is mentioned,

similarly to be applied  if i am selecting multiple options from the multi-select input as well

but,
 iam facing a issue while fetching the table in same order.

i have tried using 
|<search query>
| stats list(*) as * by user, role
but this one jumbles the column placement in alphabetical order, which i don't want to.

also,
tried using set tokens by giving the field_name starts with "nf" in one token and sf in another token.

|< search query>
| table user, role, $nf_fields$ $,sf_fields$

by trying this method also faced an issue
example: if i am selecting only sf from the multi select input
then the fields starts with nf also displayed with empty values

KR1_1-1696619012063.png

 


--> Is it possible to fix the placement of the columns.
or,
--> removing the empty columns based on the multi-select input

both approaches works for me.

Expected Output:

KR1_0-1696618145207.png

please help me to solve this.

Thanks in advance.

Labels (2)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

@KR1 

Please can you show the <input> block for your multiselect. You need to have a suitable <change> block to be able to set/unset the nf/sf tokens correctly.

 

Tags (1)
0 Karma

Thulasinathan_M
Contributor

Hi,
If un-necessary fields displaying from token, then please check whether you've unset token 'nf' when 'sf' is present and vice versa if 'nf' present then unset 'sf' fields.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @KR1,

sorry but I don't understand your issue:

is your issue on the columns or on the displayed values (as I can understand from your screenshots)?

if on the columns, is your issue that you want the columns in a specified order (which order?), or you don't want to display empty columns?

Ciao.

Giuseppe

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...